Edit tour

Linux Analysis Report
ntpd.elf

Overview

General Information

Sample name:	ntpd.elf
Analysis ID:	1585751
MD5:	bade128898469a64827d5dada62d287d
SHA1:	8763dd0050cff043ea6252aa3d73ab5c95fe1312
SHA256:	e5e475db5076e112f69b61ccb36aaedfbb7cac54a03a4a2b3c6a4a9317af2196
Tags:	elfkeypluguser-smica83
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)

ELF contains segments with high entropy indicating compressed/encrypted content

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sleeps for long times indicative of sandbox evasion

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585751
Start date and time:	2025-01-08 07:40:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ntpd.elf
Detection:	MAL
Classification:	mal48.linELF@0/0@1/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
VT rate limit hit for: cloud.googleapi.computer

Runtime Messages

Command:	/tmp/ntpd.elf
PID:	6235
Exit Code:
Exit Code Info:
Killed:	True
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

ntpd.elf (PID: 6235, Parent: 6155, MD5: bade128898469a64827d5dada62d287d) Arguments: /tmp/ntpd.elf

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ntpd.elf	ReversingLabs: Detection: 42%
Source: ntpd.elf	Virustotal: Detection: 46%			Perma Link

Source: /tmp/ntpd.elf (PID: 6235)

Reads hosts file: /etc/hosts

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: cloud.googleapi.computer

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59790
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59790 -> 443

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal48.linELF@0/0@1/0

Source: ntpd.elf

Submission file: segment LOAD with 7.8311 entropy (max. 8.0)

Source: ELF symbol in initial sample

Symbol name: usleep

Source: /tmp/ntpd.elf (PID: 6235)

Sleeps longer then 60s: 414.637s

Jump to behavior

Source: /tmp/ntpd.elf (PID: 6235)

Queries kernel information via 'uname':

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ntpd.elf	42%	ReversingLabs	Linux.Trojan.Generic
ntpd.elf	46%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cloud.googleapi.computer	8.210.201.184	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
8.210.201.184	cloud.googleapi.computer	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	tftp.elf	Get hash	malicious	Unknown	Browse
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	tftp.elf	Get hash	malicious	Unknown	Browse
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse
	spc.elf	Get hash	malicious	Mirai	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	miori.spc.elf	Get hash	malicious	Unknown	Browse	47.251.104.78
	287438657364-7643738421.08.exe	Get hash	malicious	Nitol	Browse	8.217.47.169
	i486.elf	Get hash	malicious	Mirai	Browse	47.254.187.221
	2749837485743-7684385786.05.exe	Get hash	malicious	Nitol	Browse	8.217.59.73
	Fantazy.m68k.elf	Get hash	malicious	Unknown	Browse	8.213.155.157
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	47.245.235.159
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	8.209.129.226
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse	8.217.47.169
	armv7l.elf	Get hash	malicious	Unknown	Browse	8.212.89.249
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	47.235.55.179
INIT7CH	tftp.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, stripped
Entropy (8bit):	7.818852231542011
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	ntpd.elf
File size:	3'923'032 bytes
MD5:	bade128898469a64827d5dada62d287d
SHA1:	8763dd0050cff043ea6252aa3d73ab5c95fe1312
SHA256:	e5e475db5076e112f69b61ccb36aaedfbb7cac54a03a4a2b3c6a4a9317af2196
SHA512:	b86449ac63dc626c6617e5321dc6bbc662acc501be5a0c52a75c90e04de3ac756568645e8737ffc8ca0fc0a45ce897a469c42d69e07921bc4a8b5da1b036a700
SSDEEP:	98304:QH1SnK0oDBU4cZ5PbMCSnFnwVPTnO3UcrE7WbTm:Qy1PbzS6VPTnOrE7W2
TLSH:	2306027E61843718C419C8349027FD84B1B6521E5AFDC5AAB1EBBBC07BAB521DA07F07
File Content Preview:	.ELF..............>.....CM......@.........;.........@.8...@.............@.......@.@.....@.@.....0.......0.................................@.......@...............................................@.......@.............5......... .......................`....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0xe64d43
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	10
Section Header Offset:	3921159
Section Header Size:	64
Number of Section Headers:	28
Header String Table Index:	25

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x4002a8	0x2a8	0x1c	0x0	0x2	A	0	0	1
.gnu.hash	GNU_HASH	0x13b3160	0x3b3160	0x1c	0x0	0x2	A	3	0	8
.dynsym	DYNSYM	0x13b3180	0x3b3180	0x1200	0x18	0x2	A	4	1	8
.dynstr	STRTAB	0x13b4380	0x3b4380	0x6d4	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x13b4a54	0x3b4a54	0x180	0x2	0x2	A	3	0	2
.gnu.version_r	VERNEED	0x13b4bd8	0x3b4bd8	0x120	0x0	0x2	A	4	7	8
.rela.dyn	RELA	0x13b4cf8	0x3b4cf8	0x2e8	0x18	0x2	A	3	0	8
.rela.plt	RELA	0x13b4fe0	0x3b4fe0	0xf30	0x18	0x2	A	3	10	8
.init	PROGBITS	0x401ac8	0x1ac8	0x18	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x401ae0	0x1ae0	0x600	0x10	0x6	AX	0	0	4
.text	PROGBITS	0x4020e0	0x20e0	0x172e8	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x4193c8	0x193c8	0xe	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x4193e0	0x193e0	0x44d	0x0	0x2	A	0	0	32
.eh_frame_hdr	PROGBITS	0x13b5f10	0x3b5f10	0x132c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x13b723c	0x3b723c	0x6010	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0x41e434	0x1e434	0x401	0x0	0x2	A	0	0	1
.ctors	PROGBITS	0x61f800	0x2d0	0x18	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x61f818	0x2e8	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x61f828	0x2f8	0x8	0x0	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x61f840	0x310	0x260	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x13bd24c	0x3bd24c	0x1d0	0x10	0x3	WA	4	0	8
.got	PROGBITS	0xe5a878	0x5a878	0x528	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x620000	0xad0	0x60	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x620060	0xb30	0xce8	0x0	0x3	WA	0	0	32
.shstrtab	STRTAB	0x0	0x3bd41c	0xeb	0x0	0x0		0	0	1
.upx0	PROGBITS	0x820060	0x20060	0x4482e3	0x0	0x6	AX	0	0	1
.upx1	PROGBITS	0xe002d0	0x2d0	0x3b2e90	0x0	0x6	AX	0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x400040	0x400040	0x230	0x230	2.0519	0x5	R E	0x8
INTERP	0x2a8	0x4002a8	0x4002a8	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x400000	0x400000	0x2c4	0x1e835	2.3270	0x5	R E	0x200000		.interp
LOAD	0x2d0	0x6002d0	0x6002d0	0x0	0x20a78	0.0000	0x6	RW	0x200000		.bss
DYNAMIC	0x3bd24c	0x13bd24c	0x13bd24c	0x210	0x1d0	2.5931	0x6	RW	0x8		.dynamic
GNU_EH_FRAME	0x3b5f10	0x13b5f10	0x13b5f10	0xb6c	0x132c	5.3203	0x4	R	0x4
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8
LOAD	0x2d0	0x8002d0	0x8002d0	0x0	0x468073	0.0000	0x5	R E	0x200000
LOAD	0x2d0	0xe002d0	0xe002d0	0x3b2e90	0x3b2e90	7.8311	0x7	RWE	0x200000		.got .upx1
LOAD	0x3b3160	0x13b3160	0x13b3160	0xa2bc	0xa2bc	4.6560	0x6	RW	0x200000		.gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .eh_frame_hdr .eh_frame .dynamic

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libpthread.so.0	0x1
DT_NEEDED	sharedlib	librt.so.1	0x1
DT_NEEDED	sharedlib	libutil.so.1	0x1
DT_NEEDED	sharedlib	libstdc++.so.6	0x1
DT_NEEDED	sharedlib	libm.so.6	0x1
DT_NEEDED	sharedlib	libgcc_s.so.1	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_INIT	value	0x401ac8	0xc
DT_FINI	value	0xe50749	0xd
DT_GNU_HASH	value	0x13b3160	0x6ffffef5
DT_STRTAB	value	0x13b4380	0x5
DT_SYMTAB	value	0x13b3180	0x6
DT_STRSZ	bytes	1748	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0xe5a878	0x3
DT_PLTRELSZ	bytes	3888	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x13b4fe0	0x17
DT_RELA	value	0x13b4cf8	0x7
DT_RELASZ	bytes	744	0x8
DT_RELAENT	bytes	24	0x9
DT_BIND_NOW	value	0x0	0x18
DT_FLAGS_1	value	0x1	0x6ffffffb
DT_VERNEED	value	0x13b4bd8	0x6ffffffe
DT_VERNEEDNUM	value	7	0x6fffffff
DT_VERSYM	value	0x13b4a54	0x6ffffff0
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Jv_RegisterClasses			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_Unwind_Resume	GCC_3.0	libgcc_s.so.1	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Unwind_Resume	GCC_3.0	libgcc_s.so.1	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Unwind_Resume			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSs4_Rep10_M_destroyERKSaIcE	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSs4_Rep20_S_empty_rep_storageE	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_ZNSs6appendEPKcm	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSs6appendERKSs	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSs6assignEPKcm	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSsC1EPKcRKSaIcE	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSsC1EPKcmRKSaIcE	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSsC1ERKSs	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSt8ios_base4InitC1Ev	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZNSt8ios_base4InitD1Ev	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZSt9terminatev	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZTVN10__cxxabiv117__class_type_infoE	CXXABI_1.3	libstdc++.so.6	.dynsym	0x0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_ZTVN10__cxxabiv120__si_class_type_infoE	CXXABI_1.3	libstdc++.so.6	.dynsym	0x0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
_ZdaPv	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZdaPv	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZdlPv	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_ZdlPv	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Znam	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Znam	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Znwm	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_Znwm	GLIBCXX_3.4	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_atexit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_begin_catch	CXXABI_1.3	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_finalize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__errno_location	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fxstatat	GLIBC_2.4	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__gxx_personality_v0	CXXABI_1.3	libstdc++.so.6	.dynsym	0x401fd0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gxx_personality_v0	CXXABI_1.3	libstdc++.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__pthread_key_create			.dynsym	0x0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
abort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
abort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
accept	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bind	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
clock_gettime	GLIBC_2.2.5	librt.so.1	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dirfd	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dladdr	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dladdr			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup2	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
endmntent	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execve	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fclose			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgets	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fgets			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fopen			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fseeko64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftell	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftello64	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostbyname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getmntent	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gettimeofday	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gmtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_addr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_ntoa	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ioctl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
isalnum	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
listen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
localtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
localtime_r	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
longjmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mmap			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mprotect	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mprotect			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
munmap	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
munmap			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
openpty	GLIBC_2.2.5	libutil.so.1	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
poll	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cancel	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_create	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_exit	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_join	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_destroy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_init	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_lock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_lock	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_unlock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_unlock	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutexattr_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutexattr_settype	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_sigmask	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rand	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realpath	GLIBC_2.3	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvfrom	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sched_getaffinity	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sched_setaffinity	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
select	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setmntent	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
shutdown	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigaddset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sigemptyset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
signal	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
srand	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sscanf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strchr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strdup	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strftime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strstr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtol	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
system	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
system			.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
tolower	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
uname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
usleep	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
vsprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 07:40:46.491734982 CET	59790	443	192.168.2.23	8.210.201.184
Jan 8, 2025 07:40:46.491765976 CET	443	59790	8.210.201.184	192.168.2.23
Jan 8, 2025 07:40:46.491839886 CET	59790	443	192.168.2.23	8.210.201.184
Jan 8, 2025 07:40:46.504257917 CET	59790	443	192.168.2.23	8.210.201.184
Jan 8, 2025 07:40:46.504268885 CET	443	59790	8.210.201.184	192.168.2.23
Jan 8, 2025 07:40:46.504308939 CET	443	59790	8.210.201.184	192.168.2.23
Jan 8, 2025 07:40:49.344424009 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 07:40:54.975826979 CET	42836	443	192.168.2.23	91.189.91.43
Jan 8, 2025 07:40:56.511512041 CET	42516	80	192.168.2.23	109.202.202.202
Jan 8, 2025 07:41:10.333570004 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 07:41:20.572113991 CET	42836	443	192.168.2.23	91.189.91.43
Jan 8, 2025 07:41:26.715257883 CET	42516	80	192.168.2.23	109.202.202.202
Jan 8, 2025 07:41:51.287906885 CET	43928	443	192.168.2.23	91.189.91.42
Jan 8, 2025 07:42:11.765029907 CET	42836	443	192.168.2.23	91.189.91.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 07:40:46.478492975 CET	36076	53	192.168.2.23	1.1.1.1
Jan 8, 2025 07:40:46.490884066 CET	53	36076	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 07:40:46.478492975 CET	192.168.2.23	1.1.1.1	0x4213	Standard query (0)	cloud.googleapi.computer	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 07:40:46.490884066 CET	1.1.1.1	192.168.2.23	0x4213	No error (0)	cloud.googleapi.computer		8.210.201.184	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: ntpd.elf PID: 6235, Parent PID: 6155

General

Start time (UTC):	06:40:45
Start date (UTC):	08/01/2025
Path:	/tmp/ntpd.elf
Arguments:	/tmp/ntpd.elf
File size:	3923032 bytes
MD5 hash:	bade128898469a64827d5dada62d287d

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ntpd.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: ntpd.elf PID: 6235, Parent PID: 6155

General

Chronological Activities

Linux Analysis Report
ntpd.elf